Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2637)
CWE-79 (1876)
CWE-416 (1378)
CWE-862 (1210)
CWE-89 (1111)
CWE-22 (1031)
CWE-125 (930)
CWE-306 (855)
CWE-200 (854)
CWE-122 (832)
CWE-20 (801)
CWE-787 (728)
CWE-78 (719)
CWE-918 (698)
CWE-863 (653)
CWE-94 (646)
CWE-74 (603)
CWE-639 (567)
CWE-400 (535)
CWE-119 (504)
CWE-269 (502)
CWE-502 (476)
CWE-770 (449)
CWE-287 (442)
CWE-121 (410)
CWE-190 (380)
CWE-77 (375)
CWE-362 (374)
CWE-476 (302)
CWE-352 (285)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-114133 |
medium | 5.4 | 0.0022 | 2026-10-21 | Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-isl | |
CVE-2026-93633 |
medium | 5.4 | 0.0023 | 2026-10-23 | A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user wi | |
CVE-2026-100175 |
medium | 5.4 | 0.0033 | 2026-10-28 | The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Auto | |
CVE-2026-116761 |
medium | 5.4 | 0.0022 | 2026-10-28 | The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][ | |
CVE-2026-16020 |
medium | 5.4 | 0.0013 | 2026-10-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-58524 |
medium | 5.4 | 0.0041 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ed | |
CVE-2023-22972 |
medium | 5.4 | 0.0043 | 2023-02-22 | A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_function | |
CVE-2023-28665 |
medium | 5.4 | 0.0089 | 2023-03-22 | The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-si | |
CVE-2023-28666 |
medium | 5.4 | 0.0044 | 2023-03-22 | The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scri | |
CVE-2025-65675 |
medium | 5.4 | 0.0025 | 2025-11-26 | Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attac | |
CVE-2025-51734 |
medium | 5.4 | 0.0019 | 2025-11-28 | Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0. | |
CVE-2025-63528 |
medium | 5.4 | 0.0033 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the | |
CVE-2026-4364 |
medium | 5.4 | 0.0009 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 | |
CVE-2026-1243 |
medium | 5.4 | 0.0021 | 2026-04-02 | IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. This vulnerabi | |
CVE-2026-32629 |
medium | 5.4 | 0.0027 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker | |
CVE-2026-35046 |
medium | 5.4 | 0.0017 | 2026-04-06 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. | |
CVE-2026-40212 |
medium | 5.4 | 0.0022 | 2026-04-10 | OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerab | |
CVE-2026-35600 |
medium | 5.4 | 0.0019 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embe | |
CVE-2026-32893 |
medium | 5.4 | 0.0014 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, a Reflected Cross-Site Scripting ( | |
CVE-2026-35565 |
medium | 5.4 | 0.0047 | 2026-04-13 | Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Af | |
CVE-2026-4914 |
medium | 5.4 | 0.0034 | 2026-04-14 | Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain l | |
CVE-2026-22154 |
medium | 5.4 | 0.0022 | 2026-04-14 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerabilit | |
CVE-2026-20945 |
medium | 5.4 | 0.1908 | 2026-04-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-27258 |
medium | 5.4 | 0.0018 | 2026-04-14 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could | |
CVE-2026-27288 |
medium | 5.4 | 0.0019 | 2026-04-14 | Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site | |
CVE-2026-33889 |
medium | 5.4 | 0.0022 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain | |
CVE-2026-40483 |
medium | 5.4 | 0.0022 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor | |
CVE-2026-41061 |
medium | 5.4 | 0.0017 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` re | |
CVE-2026-41063 |
medium | 5.4 | 0.0022 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete XSS fix in A | |
CVE-2026-3007 |
medium | 5.4 | 0.0017 | 2026-04-23 | Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attack | |
CVE-2026-31953 |
medium | 5.4 | 0.0014 | 2026-04-24 | Xibo is an open source digital signage platform with a web content management system and Windows dis | |
CVE-2026-41318 |
medium | 5.4 | 0.0019 | 2026-04-24 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as refe | |
CVE-2026-7026 |
medium | 5.4 | 0.0056 | 2026-04-26 | A vulnerability was determined in D-Link DGS-3420 1.50.018. This issue affects some unknown processi | |
CVE-2026-40201 |
medium | 5.4 | 0.0024 | 2026-05-01 | @diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md f | |
CVE-2026-5077 |
medium | 5.4 | 0.0019 | 2026-05-02 | The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versio | |
CVE-2026-7939 |
medium | 5.4 | 0.0016 | 2026-05-06 | Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remot | |
CVE-2026-7958 |
medium | 5.4 | 0.0014 | 2026-05-06 | Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an att | |
CVE-2026-8012 |
medium | 5.4 | 0.0014 | 2026-05-06 | Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attac | |
CVE-2026-40296 |
medium | 5.4 | 0.0022 | 2026-05-06 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skip | |
CVE-2026-42192 |
medium | 5.4 | 0.0018 | 2026-05-08 | Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cro | |
CVE-2026-42612 |
medium | 5.4 | 0.0024 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulner | |
CVE-2026-42842 |
medium | 5.4 | 0.0018 | 2026-05-11 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Si | |
CVE-2026-42857 |
medium | 5.4 | 0.0018 | 2026-05-11 | Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanit | |
CVE-2026-42877 |
medium | 5.4 | 0.0019 | 2026-05-27 | FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored | |
CVE-2026-53441 |
medium | 5.4 | 0.0026 | 2026-06-10 | Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not | |
CVE-2026-53606 |
medium | 5.4 | 0.0021 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simp | |
CVE-2026-32208 |
medium | 5.4 | 0.0052 | 2026-06-19 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft En | |
CVE-2026-9029 |
medium | 5.4 | 0.0025 | 2026-06-22 | A user with Editor permissions can place a malicious script in the attribution field of a Geomap pan | |
CVE-2026-11372 |
medium | 5.4 | 0.0023 | 2026-06-22 | IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vulnerable to cross-site scripting. This vul | |
CVE-2026-4983 |
medium | 5.4 | 0.0031 | 2026-06-23 | Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serv |